hxxps://www[.]transfernow[.]net/dl/20261007Jt9JFNTq

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.transfernow.net/dl/20261007Jt9JFNTq
Sample261014-sqrhlsty3m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1912	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{A55A844B-67CF-49B0-9E43-B09CE1C747D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3372	3532	msedge.exe	87
PID 3532 wrote to memory of 1912	3532	msedge.exe	88
PID 3532 wrote to memory of 3336	3532	msedge.exe	89
PID 3532 wrote to memory of 3336	3532	msedge.exe	89
PID 3532 wrote to memory of 3336	3532	msedge.exe	89
PID 3532 wrote to memory of 920	3532	msedge.exe	90
PID 3532 wrote to memory of 920	3532	msedge.exe	90
PID 3532 wrote to memory of 5052	3532	msedge.exe	92
PID 3532 wrote to memory of 5052	3532	msedge.exe	92
PID 3532 wrote to memory of 5052	3532	msedge.exe	92
PID 3532 wrote to memory of 3036	3532	msedge.exe	93
PID 3532 wrote to memory of 3036	3532	msedge.exe	93
PID 3532 wrote to memory of 3036	3532	msedge.exe	93
PID 3532 wrote to memory of 4368	3532	msedge.exe	94
PID 3532 wrote to memory of 2728	3532	msedge.exe	95
PID 3532 wrote to memory of 4368	3532	msedge.exe	94
PID 3532 wrote to memory of 4368	3532	msedge.exe	94
PID 3532 wrote to memory of 2728	3532	msedge.exe	95
PID 3532 wrote to memory of 2728	3532	msedge.exe	95
PID 3532 wrote to memory of 4112	3532	msedge.exe	99
PID 3532 wrote to memory of 4112	3532	msedge.exe	99
PID 3532 wrote to memory of 5032	3532	msedge.exe	100
PID 3532 wrote to memory of 5032	3532	msedge.exe	100
PID 3532 wrote to memory of 4080	3532	msedge.exe	102
PID 3532 wrote to memory of 1380	3532	msedge.exe	114
PID 3532 wrote to memory of 4320	3532	msedge.exe	115
PID 3532 wrote to memory of 3264	3532	msedge.exe	116
PID 3532 wrote to memory of 2680	3532	msedge.exe	125
PID 3532 wrote to memory of 2680	3532	msedge.exe	125
PID 3532 wrote to memory of 2376	3532	msedge.exe	127
PID 3532 wrote to memory of 2376	3532	msedge.exe	127
PID 3532 wrote to memory of 1128	3532	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.transfernow.net/dl/20261007Jt9JFNTq
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc599ec188,0x7ffc599ec194,0x7ffc599ec1a0
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,11756587472913944286,11746581679191405113,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10332515041975016133,4341497151580979912,262144 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,8846350250703153464,10274677270029135280,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1613268942162170857,4054942607640415710,2097152 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,15585316120392443547,16633833874467533478,2097152 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,8934596938874761537,10426265062437666261,2097152 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,11391604347568339089,8483950222079944883,2097152 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,1129875424394208912,7937913969128099044,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,16779195621874209373,7797650419920575452,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,1068313015710387646,7769161914488396170,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,1068313015710387646,7769161914488396170,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,15592310463243441246,12395267207734334030,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,848964591897565990,10282963291780472297,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,5628997634341355211,1015758778614576300,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,7706149247523096337,2049826856117319892,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,4253840484227097893,12542835299352853087,524288 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6268,i,7056187114130951394,14185690355418355127,262144 --field-trial-handle=2200,i,6386847458525133038,3391438553285906134,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2bf5b0e7-720f-457f-ab2a-5c4cd1c20810.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2bf5b0e7-720f-457f-ab2a-5c4cd1c20810.tmp
Size 8KB
SHA256 99a71e00ba4ff2c725f90124e7d2d99886ebe002478b8d5c1096fecf315a04e5
MD5 0bdd7474b723200bce870fd8369a171b
SHA1 0dc986b55ab0b676547059d121ea76ac47b3868a
SHA512 7e207ec0554ba6740a2643622124c370803d906b90a4fa7a78caf73d0c41ac8f7850be86bfa019bc9c55dcc74402051c7f72d06254ff633ce6b65c42cb601251
SSDEEP 96:KqONk0QsjpfbUmjH5ih/cIPURHl8h4otop5HaDMtBKP4v+Y1xf//ojdixHeYMywy:BONU6JUm0QmiUy8Uso//gyw3BCH3U6
TLSH
T1E502D839BC28BCBB9EE2AE45B0877B139FA4107BA5951F40D6D91E1D01D755C1302C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ee05013-2a8f-4923-851f-db440947f230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2ee05013-2a8f-4923-851f-db440947f230.tmp
Size 18KB
SHA256 2d69b20ac55fee78f42db28b419f4167ed884f410462b572363d4a318be81a58
MD5 8b136b4d5f85d33e1b477ba4fcccfb82
SHA1 a57d05d877841fe4d4b755fb8eeb203962083921
SHA512 921c89f146352df9da6b439bb36001f168a8ed96c9cd2add998f18c0c97fc37c37be656e79e00cbb5bf5847cb4f2e643cd3eca68f4a2cd8c5657eab04b55e80b
SSDEEP 384:cQkUSv0sN30QDjbsjVPDh//kTPysPJAxJsQIIlj:c0eAl/psPkJsQL9
TLSH
T122827C35BC65BD778DA2A550F1473A139EB0916BFAC41FA4C6CDBB2C01C62D82307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e3c202c-1d32-4be4-85c0-89f38f8940c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e3c202c-1d32-4be4-85c0-89f38f8940c5.tmp
Size 26KB
SHA256 2d2bb00b2cf63f95551ebcd85a9cde51eecc78a3a6735ca664037d05efd87aa0
MD5 9b54b4550c0864e8323ba04627f9bd69
SHA1 b6094df69bb1e3c1834e421c064b90afbc2d92b7
SHA512 00621cfe8118eb83255a8358a7bf4a6fbdfeff1ddc91ffd012eb55518fcd18e310edf3eefb98f66f89ed97867698fba9b592b2a5167ff292dd99b7bc356d664f
SSDEEP 384:eiFzQkUSvwzsNJ8TUNTUlIl0QDjbsjV4Dh//kTPQsPJAxJsQIIlj:1FdsYwgFvl/RsPkJsQL9
TLSH
T1B0C207F658D79976D96E5B43B37E2D038EBCC067B9805A50B3896A1CCC861BFD306C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ae05e53-74d2-42e0-adb6-5f37ce0b48d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9ae05e53-74d2-42e0-adb6-5f37ce0b48d0.tmp
Size 18KB
SHA256 c5c119cbac669b35d6e1eec910fc7ab32f5571535bd499a7d02858bcb3ffa0a4
MD5 354424acbe32eac609d0ef3306affe86
SHA1 44400874d4a5cb916ea0d712721f70a53a71b3c2
SHA512 b5860b02f9fad0052264523d057883cd87b6fd79f6d012d030ed0695e177a70017420e716aea338b45aac9bdf7cd17bde3643406b79881ee934cacfc9205cc23
SSDEEP 384:6QkUSv0sN3pQDjbsjVPDh//kTPysPJAxJsQIIlj:i0dAl/psPkJsQL9
TLSH
T1B2827C35BC65BD778DA2A550F1473A139EB0916BFAC41FA4C6CEBB2C01C62D82307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fb3faa9-03d1-40ac-9ece-90c8964add0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0fb3faa9-03d1-40ac-9ece-90c8964add0d.tmp
Size 105KB
SHA256 3c023366c78522106a9da07039c85fdca442b8b2524e3ef09015959fba816460
MD5 1407776b2d091c5f8f337ca833f701e7
SHA1 26ec3153e7e4ee7174d00776d5731af45502e9f1
SHA512 828cee75ffe6f6dc85f839506df778d4a85a8ecb4be27dfbd05737489c9da66bcc7c1318e30b6b931f9c0dc0ed530c46530b62098d2ec8250df235492165e080
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7O:fwUQC5VwBIiElEd2K57P7O
TLSH
T192B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

01d00eed-861e-4957-a945-0502697299c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01d00eed-861e-4957-a945-0502697299c4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0df67d28-c749-454a-a78f-4c95923966b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0df67d28-c749-454a-a78f-4c95923966b5.tmp
Size 10KB
SHA256 4f613f56c7fdc5963fc26d28c2cfb1556defc881f9ea07d1d1814aebb60bf61c
MD5 325db597234ccc5d0a449326250ba402
SHA1 706fd784c44941295a1adddb7ee9c81c4addc48e
SHA512 3e3c7f6ec92bc8a6a034605f9d879ca776ee2c8523d13728a276263ed046458aeed505ff5b3f8b7a8d5ec598aafdd2ae8f4617d942963c20ff51d661a0766cc1
SSDEEP 192:sxZOQR7W8/fJsbOIdpqJtHW6+WN9/A/Y36deWNIgrJ:sxZ3U8/fJsbfUHbK/XX9
TLSH
T13D22C956AD24AA7BCCC7D209BE55BF13D6F94131A1D01D44BAFC962C04E66DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

114fbc3c-b698-4c88-a5a8-c5186d898871.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\114fbc3c-b698-4c88-a5a8-c5186d898871.tmp
Size 27KB
SHA256 e786f53f3e01be72658700d1393f5eb43b507babf0f48e0ac3272cbff2b7ec24
MD5 8d80f44ce290c7c68901c2d93015e47b
SHA1 2046962126e50543be264d4ab91d06ea3f758f3a
SHA512 0bad9b63e70735ca3e2d660c13556fe8c2ca91c82773bdbc8dedd6b5db996934ab9cd922fcee9a2bd7db742f41324e6297a443c1b186b07d1f9f6f26f818bc57
SSDEEP 768:QiKlm7QWvUYm08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/XroFX:QiKlm7QWvUYm0u1ja8/L/E/EFX
TLSH
T17FC2FB3B640CCB7E4FC05A9DDC5A6F9B6EA802C7A6588D4047FA984C02C77EE51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28e55649-3719-43c0-8d4f-fb0d7e116fee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28e55649-3719-43c0-8d4f-fb0d7e116fee.tmp
Size 10KB
SHA256 7a4a7ed5c0ea383e9399f2897f3cdd64053e0ce39ca3c4459abdf4ba44155ce5
MD5 20e28997954a3f3b3671a7f1c805ca6e
SHA1 cb1264422de46ca97c458367a4a7facac6ce48a0
SHA512 488961e4f25c7d9e91f696f72fed486c45271797ada4da67969af00861379bf6deaa9b7a2e53b77cfc15a7d6b09c2fcaa6c52fa5d8ebf04e294f7437d9853b59
SSDEEP 192:sxZOQR7W8/fJsbOIdpqJtHW6+WN9/A/Y36+EWNIg52J:sxZ3U8/fJsbfUHbK/XGg
TLSH
T1F622C856AD286A7BCCC7D209BA55BF13D6F95132A1D11E44BAFCCA2C04E66CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5f97318d5136851849118cdcf496551af0f7476a74322cce6d52f16e89c0bbfd
MD5 5a5c94ef88cf94942dbb30da868f70d1
SHA1 96dd1150fe874ad8d4efb5ad2789339d0aad71bb
SHA512 411712b43b4b1b735ddc5f40ba4563b8979052ff43b1e10db7a174651f2312487ce2d2bb6d36aaf68c5f96fe502b8f587b3ae31705179598b427ef728b8910f7
TLSH
T15FE026D904CAD23FA70CA5C70BB8630DC3A0261ED2C06D9E7708C584764AB44A68E6B4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ac17cd0fbf9407d552786245a9d48b3fda2e2ac26d5da098e049e8498ef4f587
MD5 0783b35019d87a42d0f5fccdca7bae54
SHA1 b3e97b4ace2eee54d8b1ff654c2a4b83778c7f9f
SHA512 2d014ed446c9aacedea60b1e661851cd18bd215c7a7a1b6b8b35887a6b33d5617eaf2c22c76d0fe14fed70c294d44da0770721654b967a2b520b6a31e4335f87
TLSH
T10471C85050E0C46ADB5896B8F1F1654E3938597151CF9E5A20F6E5BF8B4FB6CE3E00A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9ad1b0203969b4db9b8addad0f1f171c713874cc3a03f74f297916e88bbc3e1
MD5 e5b9f3acb1e1633e5dd9adb68c05e397
SHA1 71c90ba4479ee291b20a10925cd577e34fcd877f
SHA512 5ac6cf95aaf5c775973ac5ec6d2100218e4f9920e7e48702f44e2a4959c4f8ff1a8429cbf0b05e73fc646b7fc6ece4712a3075683fe03ee23c922456236e8cee
TLSH
T144613D8051E0C0A6EBA8D671F1F6928F3928A57145CFAD5A20F6C9BF4B4FB5CD3D50A0
MD5 SHA1 SHA512 TLSH

Submit Download

be5af6bb-5242-49ba-aa01-616e63ac99c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\be5af6bb-5242-49ba-aa01-616e63ac99c9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

18544d74-5020-4d67-80fa-a8a76baa9eb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18544d74-5020-4d67-80fa-a8a76baa9eb8.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

6944f074-039e-49c4-8d32-2faa428b14a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6944f074-039e-49c4-8d32-2faa428b14a0.tmp
Size 4KB
SHA256 84b23f816805f180bca604b74cfd141b225efd9f19621804bc2a94a3424bc6ba
MD5 92d4966aba71faf3b2de0ad3a53bb4c2
SHA1 013fea2b259e6586cf9c05bbf661ff3176147a82
SHA512 b13babdc6b6aa10a0285c662f3edfb67e40bd311434537fc6f78c2bcb9ce3d5c295df7d19cfe548afb27d1421fb864675e41c865c71502f8117c2a69740d7ccb
SSDEEP 96:DiO0e4FEedtvdzBWPpjMZE9EcWVR26TWp65IAwQ:Dh0ePedtV1WPpjMm9EcWVRnTWp65lT
TLSH
T1EC919CF782E4C92E885156F197243E2FCE6D0519521C385DC9E5EF4BE7E24A1F200A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7edd94d0-34dd-4854-b034-7c31dbcf678f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7edd94d0-34dd-4854-b034-7c31dbcf678f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9f2f8d2dd7b7d486c61d7b6e7b7698c521d1ea6d5a2feb35efce2ded7975ce05
MD5 ad5c17b35d2d79db09edeb2dbcfd22b3
SHA1 b10dfeada7c2ca8f4416b3b5fa2f447bf72aec35
SHA512 0cc33b76f39dde48251b58c44884658ef056750cd2e8d86112adf130431ee2c9c04f1eb57f734e767ff3b181e8a99ae3a85ea9f2242eae7f635320748a03a089
SSDEEP 96:KMWEKbKmKSMKjCKC/406E4zvoVCR8zKpqRuz9yKtQ4QILIHLN:CDH5C/406E4roVE8iqRuRyKtQ4QILIHZ
TLSH
T16691674570BB425079FD754846A8872E017271733019E96BBFBC80568DAFF090EFE9DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4c3f23a-92d4-489a-92b9-353448463342.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4c3f23a-92d4-489a-92b9-353448463342.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

db8e740e-7478-4b50-894e-7d591a1ff0a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db8e740e-7478-4b50-894e-7d591a1ff0a9.tmp
Size 10KB
SHA256 d2a84fdebaf1e59ae41271e83472c91d3da527b5721ee89398d35125b0be508a
MD5 8188e671667a35e61043d5c8d5a32eb0
SHA1 8aac0c397d1b5f76a92d357e3d813ff27c63989d
SHA512 1d09b2c139e2e87b6e815c95841cff0c798512450867793df322b0317988b0e656a1c77df87eff88bf96ee61113bf3e568ff922f679687acd0e5afd26ef771f4
SSDEEP 192:sxZOQR7W8/fJswOIdpqJtHW6+WN9/A/Y36deWNIg5UJ:sxZ3U8/fJswfUHbK/XXi
TLSH
T1BF22D916AD28AA7BCCC7D219BA55BF13D6F94131A1D01E44BAFC8A2C04E67DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f25a9827-9079-475a-a264-1da6a7165fb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f25a9827-9079-475a-a264-1da6a7165fb1.tmp
Size 10KB
SHA256 a06eeba07604b4a2e9ce5e7774d40a11cea23faf606e549283e4fe5316044420
MD5 41c9a1436521dd87bb0283fc6923612f
SHA1 69994f829497dd76a5fb63148836fa57613a406d
SHA512 3cffbf4d46c2673fe785ad8c2e14e51e1ff2c628c635d1ab10adfbf3fc445a266d24b81dc77b2429e9fb2eb1b57aad5cb6c744600b7efdfd428071d5f1e2773c
SSDEEP 192:sxZOQR7W8/fJsbOIdpkJtHW6+WN9/A/Y3673WNIg52J:sxZ3U8/fJsbfeHbK/Xog
TLSH
T19932C956AD286A7BCCC7D209BA55BF13D6F95031A1D01E48BAFCCA2C04E66DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bdcc157-3b83-4647-a436-c29eb70a9d59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8bdcc157-3b83-4647-a436-c29eb70a9d59.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

63713691-71d8-4826-9045-e853c578de1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63713691-71d8-4826-9045-e853c578de1b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fe35673c-b955-4d3c-b951-ddef2abdead9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe35673c-b955-4d3c-b951-ddef2abdead9.tmp
Size 8KB
SHA256 148f7c6ffe4364410cbbfc355897f70635549b697604ba7219df5cfd3710c280
MD5 e2c69cfc0f81e27ff01262764d94a61b
SHA1 c20c996e9075f60134d6fc541edb24e7d4dba7a5
SHA512 f5a69943b0104ae95180d87da2e1c16487ec0d18d7a181de2f5fdb5da7d64d62a9084c1aed3871a74d2199ce61b0de4e425570216f539cf0218333516e64ef93
SSDEEP 192:+ONK6JU7QmiUyZxURo//gywTPAQNxiqMU6:+ONK6+t6aRo//kTP7sU6
TLSH
T1A0121A35B868EC7B9D92A595F08336139EA0417BEB895F90D5DD2F2C02DB1AC5307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c7d10aef473fbc613b83bc52085ed26e0d64d42cd882bd96e6cce6d7ac06a900
MD5 123d2dc18f7bf6fc086a89b9af87f03d
SHA1 70b58a8e414ef9adf3c9ff277d1367c334ea13d2
SHA512 0a0bd074373626f5965c2eeb1c870549f994fdcdd6dcac0022bcfa927f4686d3f262ab6971c96ca5ab5d56d77e2fac89aa4d2fbd1203f44494a2f013ad652b18
TLSH
T1E841F55CA6F91108B3B7AF5A9BF6986D487AB8771F0BD55D00110D8F0A32B40C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download